Chrome lets hackers phish even 'Unphishable' Yubikey users

Re:Chrome lets hackers phish even 'Unphishable' Yubikey users by Ajedi32 on Friday March 02, 2018 @03:11PM (#16505242)

Then click "deny", or (in the case of a native app) refuse to install the executable. Either way you're safe.

For those that _do_ require [such use cases][1] though; they can now do so without needing to expose their system to an unsandboxed native app.

[1]: https://wicg.github.io/webusb/#motivating-applications

[ Parent | on HN ]

Re:Chrome lets hackers phish even 'Unphishable' Yubikey users by Sir_Cmpwn on Friday March 02, 2018 @03:16PM (#16505287)

I know to do that. How about my grandma, who just clicks whatever button looks like it'll make the message go away sooner?

The web is a disaster and WebUSB is a prime piece of evidence supporting this.

[ Parent | on HN ]

Re:Chrome lets hackers phish even 'Unphishable' Yubikey users by Ajedi32 on Friday March 02, 2018 @03:35PM (#16505444)

Would that include the "Run" button on a downloaded executable?

While obviously we want to do as much as we can to discourage users from shooting themselves in the foot, there are limits. At some point, eventually you _do_ have to trust that the user knows what he's doing.

Giving users a choice on when to allow a page access to one specific USB device is not a "disaster".

[ Parent | on HN ]